Extracted

• • Target

    94b93c10c7fe4a27cadfb98ea8e197a368f29bfaa691b52a37b6c7e1af4a0700

  • Size

    728KB

  • MD5

    0933577445ee1111d57dd999cf983a00

  • SHA1

    42f59acb869036f94bb4e3eb0807f98e36026718

  • SHA256

    94b93c10c7fe4a27cadfb98ea8e197a368f29bfaa691b52a37b6c7e1af4a0700

  • SHA512

    a89505d683057dbaa3b51b200fa1334793dbfd6ed7d99fd99cbb1dc8bf5dec6d6d3a9f03d5e4f4c81c6ae370930c8ec3e9619b4c6af4bcddaae1685c745b6ec9

  • SSDEEP

    12288:7iLERtSJj3culKz/LXzqCFeJ8eAQlfmO8hzrFsaCT6xwb2T99X//Mbt:71ij3cJzTXz/Ub8NYmxxTnX

  Score

  10^/10

  darkcometinstallspersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2